Don't add ATC table name to registry until after sqlite DB initialization by astrocox · Pull Request #8233

Don't add ATC table name to registry until after sqlite DB initialization by astrocox · Pull Request #8233 · osquery/osquery

I was having the same issue for moz_bookmarks:

E0301 11:34:47.283597 -640033728 virtual_table.cpp:1115] Error creating named virtual table: firefox_bookmarks (1)

And I was guessing this could be due to the path in the ATC file:

{
  "auto_table_construction": {
    "firefox_bookmarks": {
      "platform": "darwin",
      "query": "SELECT * FROM moz_bookmarks;",
      "path": "/Users/%/Library/Application Support/Firefox/Profiles/%/places.sqlite",
      "columns": [
        "id",
        "type",
        "fk",
        "parent",
        "position",
        "title",
        "keyword_id",
        "folder_type",
        "dateAdded",
        "lastModified",
        "guid",
        "syncStatus",
        "syncChangeCounter"
      ]
    }
}

There are two (or probably more) profiles in the Profiles folder, so here comes the problem. I guess the fix will also be solving this, right?

Thanks!